The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 172.67.169.55 on port 443 TCP: $ telnet 172.67.169.55 443 Trying 172.67.169.55… Connected to 172.67.169.55. Escape character… Читать далее RedLineStealer botnet controller @172.67.169.55
RedLineStealer botnet controller @172.67.130.64
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse. Malware botnet controller located at 172.67.130.64 on port 443 TCP: $ telnet 172.67.130.64 443 Trying 172.67.130.64… Connected to 172.67.130.64. Escape character… Читать далее RedLineStealer botnet controller @172.67.130.64
Credit card fraud gang hosting (DNS): zuganov-lox.ru (hacked-paypal-accounts-dump.ru / fe-shop.su / vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
ns1.zuganov-lox.ru. 14400 IN A 164.132.216.32 ns2.zuganov-lox.ru. 14400 IN A 164.132.216.35 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 83.220.174.184 ns2.zuganov-lox.ru. 14400 IN A 85.143.220.177 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 109.248.133.96 ns2.zuganov-lox.ru. 14400 IN A 185.117.155.168 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 94.142.143.206 ns2.zuganov-lox.ru. 14400 IN A 185.170.10.55 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 185.87.51.144 ns2.zuganov-lox.ru. 14400… Читать далее Credit card fraud gang hosting (DNS): zuganov-lox.ru (hacked-paypal-accounts-dump.ru / fe-shop.su / vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
Credit card fraud gang hosting (DNS): zuganov-lox.ru (hacked-paypal-accounts-dump.ru / fe-shop.su / vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
ns1.zuganov-lox.ru. 14400 IN A 164.132.216.32 ns2.zuganov-lox.ru. 14400 IN A 164.132.216.35 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 83.220.174.184 ns2.zuganov-lox.ru. 14400 IN A 85.143.220.177 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 109.248.133.96 ns2.zuganov-lox.ru. 14400 IN A 185.117.155.168 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 94.142.143.206 ns2.zuganov-lox.ru. 14400 IN A 185.170.10.55 ____________________ Was: ns1.zuganov-lox.ru. 14400 IN A 185.87.51.144 ns2.zuganov-lox.ru. 14400… Читать далее Credit card fraud gang hosting (DNS): zuganov-lox.ru (hacked-paypal-accounts-dump.ru / fe-shop.su / vmad.su / amazingdumpsshop.ru / cvv-fullz-shop.ru etc.)
Spammer DNS hosting (cybercrime forums)
188.120.242.136 is currently in use as a nameserver for spamvertized domains. This enables the resolving of spammed domains to the actual websites. This SBL record can only be removed if 188.120.242.136 stops answering DNS queries for spamvertized domain names. 1 Nameservers seen on 188.120.242.136: NS1.DOMEN-DOMIK.RU — 1shnurok.ru — 1sns.ru — 2rich4bitches.ru — 2rich4bitches.su — 2tracks24.net… Читать далее Spammer DNS hosting (cybercrime forums)
Spammer DNS hosting (cybercrime forums)
62.109.27.111 is currently in use as a nameserver for spamvertized domains. This enables the resolving of spammed domains to the actual websites. This SBL record can only be removed if 62.109.27.111 stops answering DNS queries for spamvertized domain names. NS2.DOMEN-DOMIK.RU — 1shnurok.ru — 1sns.ru — 2rich4bitches.ru — 2rich4bitches.su — 2tracks24.net — 3oprint.ru — abro.su —… Читать далее Spammer DNS hosting (cybercrime forums)
spam emitter @23.249.218.3
Received: from d218-3.smtp-out.eu-west-2.amazonses.com (23.249.218.3) From: Stefan Fredriksson <stefan@primemarketventure.com> Subject: Enligt överenskommelsen [], mer information inför mötet på Måndag Date: Thu, 7 Oct 2021 08:5x:xx +0000
Spamvertised website
Received: from charitaccosia.xyz (charitaccosia.xyz. [185.34.52.141]) Date: [mail_date] Subject: [], Please confirm receipt N�[]<�<�<� From: — Costco <info@messages.webmd.com> https://bit.ly/3a7eqca#[] 34.235.113.75 http://lightsoftbox.nl/track/[] 135.125.200.185
spam emitter @45.79.204.10
Received: from maryli.com (45.79.204.10) From: Es tut uns leid<reply@AmazonSamsung .ru!>;<service@stayfriends.de> Subject: [], wir vergeben dein AMAZON-Gutschein an einen anderen Teilnemer weiter. Date: Wed, 06 Oct 2021 18:3x:xx +0000
spam emitter @172.104.159.38
Received: from dicang.com (172.104.159.38) From: Aktuelle Nachrichten<reply@cryptowin.ru!>;<service@stayfriends.de> Subject: „Höhle der Löwen“ macht Schweizer reich mit Öl! Date: Thu, 07 Oct 2021 04:0x:xx +0000